Sub-processors
These providers process personal data in customer engagement files on our behalf, as authorised by Annex 3 of the Data Processing Schedule. We email every firm administrator at least 15 days before adding or replacing one.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| VercelVercel Inc. | Application hosting, delivery and AI Gateway | Customer Data in application requests and AI prompts and responses passing through the gateway; necessary technical metadata | Application compute in London, UK |
| SupabaseSupabase Inc. | Database, file storage, authentication and real-time collaboration | The primary store of Customer Data: engagement records, files, workspace identifiers, permissions and related authentication data | London, UK |
| AnthropicThrough Vercel AI Gateway | Primary AI model inference | Selected working papers, evidence, prompts, context and the resulting AI outputs. No training; zero data retention | Available on request |
| OpenAIThrough Vercel AI Gateway | Automatic fallback AI inference when the primary service is unavailable | As Anthropic, when used. No training; zero-retention endpoints only | Available on request |
| GoogleGemini models, through Vercel AI Gateway | Automatic fallback AI inference when the primary service is unavailable | As Anthropic, when used. No training; zero-retention endpoints only | Available on request |
| ResendResend | Transactional email delivery | Names, email addresses and limited notification content about engagement activity | EU |
| Amazon Web ServicesAmazon Web Services EMEA SARLFrom 5 November 2026 | Backup storage for files held on the Platform | Encrypted, write-once copies of stored files, such as working papers and audit evidence, removed within 45 days after a file is deleted or replaced | London, UK |
Changes
We're adding Amazon Web Services (Amazon Web Services EMEA SARL) to hold encrypted backup copies of files stored on the Platform, in London (eu-west-2). The copies are write-once, used only to restore the Platform, and removed within 45 days after a file is deleted or replaced. Takes effect 5 November 2026.
First published list, as Annex 3 of the Data Processing Schedule.